Product Security Engineer – AI Software Development

San Diego, CA

Full-time

Onsite

$141K/yr - $211K/yr

Entry, Mid, Senior Level

Qualcomm is a global technology innovator enabling next-generation experiences through its AI software engineering engine. The Product Security Engineer will evaluate system architectures for security gaps, conduct security assessments, and build automated security tools to ensure the resilience and trustworthiness of AI software.

Apply Now

Responsibilities

Evaluate AISW Team’s products for security gaps early in the development lifecycle, partnering with engineering teams from ideation through release
Conduct security design reviews, threat modeling sessions, and architecture assessments to surface attack surfaces and trust-boundary risks
Monitor the threat landscape to identify newly disclosed vulnerabilities, adversarial techniques, and emerging attack patterns relevant to AISW products
Leverage threat intelligence to inform adversary emulation scenarios, including campaign design, TTP selection aligned with MITRE ATT&CK, and operational sequencing
Develop and maintain automated solutions for threat emulation, improving accuracy and efficiency in detection validation
Analyze telemetry generated from simulations to assess detection coverage, identify gaps, and recommend improvements
Develop and maintain security guidance documentation including policies, procedures, and best practices as a living reference for the AISW organization
Systematically discover, validate, triage, and track security vulnerabilities from internal teams, automated scanners, and external security researchers
Manage the full vulnerability lifecycle; from initial report through rescan validation, applying concepts such as severity scoring (CVSS), KEV prioritization, risk acceptance, ownership assignment, and aging governance
Support zero-day escalation events: rapidly iterate through the VM lifecycle, produce custom impact reports, and drive time-sensitive remediation decisions
Apply working knowledge of DevSecOps tooling including SAST, SCA, DAST, container scanning, secrets scanning, and SBOM generation
Continuously hunt for exploitable vulnerabilities across applications, infrastructure, developer toolchains, and AI model pipelines
Perform comprehensive security assessments across AI development workflows, documenting findings with reproduction steps, exploitability analysis, impact assessment, and actionable remediation guidance
Build automated security testing tools and agentic workflows — leveraging LLM-driven pipelines — to scale vulnerability discovery, threat emulation, and CI/CD security gating across Stub APIs and build pipelines
Advocate for and drive the creation and deployment of new detection mechanisms, paved-path security solutions, and offensive tooling improvements
Lead security outreach efforts including post-mortem reviews, vulnerability disclosure coordination, and security advocacy programs
Provide security training and conduct outreach sessions with internal development teams to embed a security-conscious culture across AISW
Collaborate across business units (Auto BU, MLG, QSIO) on security feature enablement, product sign-off, and risk treatment decisions
Manage security update release processes and support coordination and disclosure activities with customers and OEM partners

Qualification

Required

Bachelor's degree in Computer Science, Engineering, Information Systems, or related field and 2+ years of Hardware Engineering, Software Engineering, Systems Engineering, or related work experience
OR Master's degree in Computer Science, Engineering, Information Systems, or related field and 1+ year of Hardware Engineering, Software Engineering, Systems Engineering, or related work experience
OR PhD in Computer Science, Engineering, Information Systems, or related field

Preferred

Master's degree in Computer Science, Cybersecurity, Electrical Engineering, or a related field
2+ years of experience in offensive or product security roles, inclusive of software development experience
2+ years of hands-on penetration testing, product security assessment, application security, cloud security, or equivalent offensive security experience
Experience performing security activities across one or more SDLC phases: security design review, threat modeling, secure code review, and security testing
Experience building or evaluating AI-driven vulnerability discovery pipelines
Experience with reverse engineering and low-level systems analysis (IDA Pro, Ghidra, LLDB)
Proficiency in Python and/or C/C++; experience with scripting for security automation and code review
Familiarity with DevSecOps tooling: SAST, SCA, DAST, container scanning, secrets scanning, and SBOM tooling
Working knowledge of vulnerability management concepts: CVSS, KEV, false positives, rescan validation, risk acceptance, and dependency management
Familiarity with global automotive cybersecurity regulations and standards, including ISO/SAE 21434 and UN R155
Experience on product security for embedded devices, which may include a subset of the following skillsets: Device integrity and authentication, Secure communications, Trusted execution environment (TEE), Protected virtualization and platform isolation techniques, Embedded/real time OS security, Hardware access control, Secure provisioning and debug, Key management and applied crypto
Excellent written and verbal communication skills, with the ability to collaborate effectively across engineering, product, and leadership teams
Proven track record in security research, vulnerability discovery, or security publication
Familiarity with global regulations and industry standards, including ISO/SAE 21434, UN R155, GDPR, and CRA
Knowledge of adversarial machine learning and model robustness techniques (e.g., MITRE ATLAS)
Experience working in regulated environments, including automotive, healthcare, finance, or defense
Strong understanding of secure software development practices and cloud security (AWS, Azure, or GCP)
Industry certifications such as OSCP, OSED, GXPN, GREM, CISSP, CISM, or equivalent GIAC certifications
Proficiency in one or more programming languages: Python, C, or C++
Solid understanding of common vulnerability classes: memory corruption, logic flaws, and authentication bypass
Strong understanding of modern AI/LLM system failure modes (e.g., prompt injection, data exfiltration, model misuse)
Excellent written and verbal communication skills, with the ability to collaborate effectively across engineering, product, and leadership teams

Benefits

Competitive annual discretionary bonus program
Opportunity for annual RSU grants (employees on sales-incentive plans are not eligible for our annual bonus)
Highly competitive benefits package is designed to support your success at work, at home, and at play

Qualcomm designs wireless technologies and semiconductors that power connectivity, communication, and smart devices.

Glassdoor